On Tue, Jun 16, 2015 at 04:32:31PM -0700, [email protected] wrote: > I have 2 CentOS 6 clients both running FreeIPA client 3.0.0-42 and sssd > 1.11.6-30. The server is CentOS 7 / IPA 4.1.3 > > When I try to log in using MIT kerberos and a valid ticket it works on one > client, and fails on the other. I have compared the /etc/krb5.conf, > /etc/sssd/sssd.conf and /etc/openldap/ldap.conf files on both clients and > they are identical (other than the hostnames). I can't seem to find any > other difference between the clients. > > Password authentication works on both machines. > > Here is the dub log of the failed login machine (sshd) > > I think the relevant line is the very last one where it postpones the > login for some reason > > Postponed gssapi-with-mic for username from 10.5.5.57 port 15076 ssh2
This message is in the other log as well and I think this is ok. Have you check if the keytab on the host with issue has the latest key version? To check the call 'klist -k' as root on the server and then call 'kvno host/...' with the principal shown in the klist output. Both kvno numbers should be the same. If they differ call ipa-getkeytab on the server to get a fresh keytab. Please note that you have to call kdestory and kinit on the client to remove the old now invalid ticket from the client's credential cache. HTH bye, Sumit > =========================================== > [root@fe1 pam.d]# /usr/sbin/sshd -p 22 -D -ddd -e > debug2: load_server_config: filename /etc/ssh/sshd_config > debug2: load_server_config: done config len = 687 > debug2: parse_server_config: config /etc/ssh/sshd_config len 687 > debug3: /etc/ssh/sshd_config:21 setting Protocol 2 > debug3: /etc/ssh/sshd_config:36 setting SyslogFacility AUTHPRIV > debug3: /etc/ssh/sshd_config:66 setting PasswordAuthentication yes > debug3: /etc/ssh/sshd_config:70 setting ChallengeResponseAuthentication no > debug3: /etc/ssh/sshd_config:82 setting GSSAPICleanupCredentials yes > debug3: /etc/ssh/sshd_config:98 setting AcceptEnv LANG LC_CTYPE LC_NUMERIC > LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES > debug3: /etc/ssh/sshd_config:99 setting AcceptEnv LC_PAPER LC_NAME > LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT > debug3: /etc/ssh/sshd_config:100 setting AcceptEnv LC_IDENTIFICATION > LC_ALL LANGUAGE > debug3: /etc/ssh/sshd_config:101 setting AcceptEnv XMODIFIERS > debug3: /etc/ssh/sshd_config:107 setting X11Forwarding yes > debug3: /etc/ssh/sshd_config:120 setting UseDNS no > debug3: /etc/ssh/sshd_config:130 setting Subsystem sftp > /usr/libexec/openssh/sftp-server > debug3: /etc/ssh/sshd_config:137 setting KerberosAuthentication no > debug3: /etc/ssh/sshd_config:138 setting PubkeyAuthentication yes > debug3: /etc/ssh/sshd_config:139 setting UsePAM yes > debug3: /etc/ssh/sshd_config:140 setting GSSAPIAuthentication yes > debug3: /etc/ssh/sshd_config:141 setting AuthorizedKeysCommand > /usr/bin/sss_ssh_authorizedkeys > debug1: sshd version OpenSSH_5.3p1 > debug3: Not a RSA1 key file /etc/ssh/ssh_host_rsa_key. > debug1: read PEM private key done: type RSA > debug1: private host key: #0 type 1 RSA > debug3: Not a RSA1 key file /etc/ssh/ssh_host_dsa_key. > debug1: read PEM private key done: type DSA > debug1: private host key: #1 type 2 DSA > debug1: rexec_argv[0]='/usr/sbin/sshd' > debug1: rexec_argv[1]='-p' > debug1: rexec_argv[2]='22' > debug1: rexec_argv[3]='-D' > debug1: rexec_argv[4]='-ddd' > debug1: rexec_argv[5]='-e' > debug3: oom_adjust_setup > Set /proc/self/oom_score_adj from 0 to -1000 > debug2: fd 3 setting O_NONBLOCK > debug1: Bind to port 22 on 0.0.0.0. > Server listening on 0.0.0.0 port 22. > debug2: fd 4 setting O_NONBLOCK > debug1: Bind to port 22 on ::. > Server listening on :: port 22. > debug3: fd 5 is not O_NONBLOCK > debug1: Server will not fork when running in debugging mode. > debug3: send_rexec_state: entering fd = 8 config len 687 > debug3: ssh_msg_send: type 0 > debug3: send_rexec_state: done > debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8 > debug3: recv_rexec_state: entering fd = 5 > debug3: ssh_msg_recv entering > debug3: recv_rexec_state: done > debug2: parse_server_config: config rexec len 687 > debug3: rexec:21 setting Protocol 2 > debug3: rexec:36 setting SyslogFacility AUTHPRIV > debug3: rexec:66 setting PasswordAuthentication yes > debug3: rexec:70 setting ChallengeResponseAuthentication no > debug3: rexec:82 setting GSSAPICleanupCredentials yes > debug3: rexec:98 setting AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME > LC_COLLATE LC_MONETARY LC_MESSAGES > debug3: rexec:99 setting AcceptEnv LC_PAPER LC_NAME LC_ADDRESS > LC_TELEPHONE LC_MEASUREMENT > debug3: rexec:100 setting AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE > debug3: rexec:101 setting AcceptEnv XMODIFIERS > debug3: rexec:107 setting X11Forwarding yes > debug3: rexec:120 setting UseDNS no > debug3: rexec:130 setting Subsystem sftp /usr/libexec/openssh/sftp-server > debug3: rexec:137 setting KerberosAuthentication no > debug3: rexec:138 setting PubkeyAuthentication yes > debug3: rexec:139 setting UsePAM yes > debug3: rexec:140 setting GSSAPIAuthentication yes > debug3: rexec:141 setting AuthorizedKeysCommand > /usr/bin/sss_ssh_authorizedkeys > debug1: sshd version OpenSSH_5.3p1 > debug3: Not a RSA1 key file /etc/ssh/ssh_host_rsa_key. > debug1: read PEM private key done: type RSA > debug1: private host key: #0 type 1 RSA > debug3: Not a RSA1 key file /etc/ssh/ssh_host_dsa_key. > debug1: read PEM private key done: type DSA > debug1: private host key: #1 type 2 DSA > debug1: inetd sockets after dupping: 3, 3 > Connection from 10.5.5.57 port 15076 > debug1: Client protocol version 2.0; client software version > PuTTY_Release_0.63 > debug1: no match: PuTTY_Release_0.63 > debug1: Enabling compatibility mode for protocol 2.0 > debug1: Local version string SSH-2.0-OpenSSH_5.3 > debug2: fd 3 setting O_NONBLOCK > debug2: Network child is on pid 554 > debug3: preauth child monitor started > debug3: mm_request_receive entering > debug3: privsep user:group 74:74 > debug1: permanently_set_uid: 74/74 > debug1: list_hostkey_types: ssh-rsa,ssh-dss > debug1: SSH2_MSG_KEXINIT sent > debug3: Wrote 840 bytes for a total of 861 > debug1: SSH2_MSG_KEXINIT received > debug2: kex_parse_kexinit: > diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 > debug2: kex_parse_kexinit: ssh-rsa,ssh-dss > debug2: kex_parse_kexinit: > aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] > debug2: kex_parse_kexinit: > aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] > debug2: kex_parse_kexinit: > hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 > debug2: kex_parse_kexinit: > hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 > debug2: kex_parse_kexinit: none,[email protected] > debug2: kex_parse_kexinit: none,[email protected] > debug2: kex_parse_kexinit: > debug2: kex_parse_kexinit: > debug2: kex_parse_kexinit: first_kex_follows 0 > debug2: kex_parse_kexinit: reserved 0 > debug2: kex_parse_kexinit: > diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1 > debug2: kex_parse_kexinit: ssh-rsa,ssh-dss > debug2: kex_parse_kexinit: > aes256-ctr,aes256-cbc,[email protected],aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128 > debug2: kex_parse_kexinit: > aes256-ctr,aes256-cbc,[email protected],aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128 > debug2: kex_parse_kexinit: hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5 > debug2: kex_parse_kexinit: hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5 > debug2: kex_parse_kexinit: none,zlib > debug2: kex_parse_kexinit: none,zlib > debug2: kex_parse_kexinit: > debug2: kex_parse_kexinit: > debug2: kex_parse_kexinit: first_kex_follows 0 > debug2: kex_parse_kexinit: reserved 0 > debug2: mac_setup: found hmac-sha2-256 > debug1: kex: client->server aes256-ctr hmac-sha2-256 none > debug3: mm_request_send entering: type 78 > debug3: mm_request_receive_expect entering: type 79 > debug3: mm_request_receive entering > debug3: monitor_read: checking request 78 > debug3: mm_request_send entering: type 79 > debug3: mm_request_receive entering > debug2: mac_setup: found hmac-sha2-256 > debug1: kex: server->client aes256-ctr hmac-sha2-256 none > debug3: mm_request_send entering: type 78 > debug3: mm_request_receive_expect entering: type 79 > debug3: mm_request_receive entering > debug3: monitor_read: checking request 78 > debug3: mm_request_send entering: type 79 > debug3: mm_request_receive entering > debug1: SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received > debug3: mm_request_send entering: type 0 > debug3: mm_choose_dh: waiting for MONITOR_ANS_MODULI > debug3: mm_request_receive_expect entering: type 1 > debug3: monitor_read: checking request 0 > debug3: mm_request_receive entering > debug3: mm_answer_moduli: got parameters: 1024 4096 8192 > debug3: mm_request_send entering: type 1 > debug2: monitor_read: 0 used once, disabling now > debug3: mm_request_receive entering > debug3: mm_choose_dh: remaining 0 > debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent > debug3: Wrote 536 bytes for a total of 1397 > debug2: dh_gen_key: priv key bits set: 267/512 > debug2: bits set: 2090/4096 > debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT > debug2: bits set: 2058/4096 > debug3: mm_key_sign entering > debug3: mm_request_send entering: type 5 > debug3: mm_key_sign: waiting for MONITOR_ANS_SIGN > debug3: mm_request_receive_expect entering: type 6 > debug3: mm_request_receive entering > debug3: monitor_read: checking request 5 > debug3: mm_answer_sign > debug3: mm_answer_sign: signature 0x7fb4d9b67ba0(271) > debug3: mm_request_send entering: type 6 > debug2: monitor_read: 5 used once, disabling now > debug3: mm_request_receive entering > debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent > debug2: kex_derive_keys > debug2: set_newkeys: mode 1 > debug2: cipher_init: set keylen (16 -> 32) > debug1: SSH2_MSG_NEWKEYS sent > debug1: expecting SSH2_MSG_NEWKEYS > debug3: Wrote 1104 bytes for a total of 2501 > debug2: set_newkeys: mode 0 > debug2: cipher_init: set keylen (16 -> 32) > debug1: SSH2_MSG_NEWKEYS received > debug1: KEX done > debug3: Wrote 64 bytes for a total of 2565 > debug1: userauth-request for user username service ssh-connection method none > debug1: attempt 0 failures 0 > debug3: mm_getpwnamallow entering > debug3: mm_request_send entering: type 7 > debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM > debug3: mm_request_receive_expect entering: type 8 > debug3: mm_request_receive entering > debug3: monitor_read: checking request 7 > debug3: mm_answer_pwnamallow > debug2: parse_server_config: config reprocess config len 687 > debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1 > debug3: mm_request_send entering: type 8 > debug2: monitor_read: 7 used once, disabling now > debug3: mm_request_receive entering > debug2: input_userauth_request: setting up authctxt for username > debug3: mm_start_pam entering > debug3: mm_request_send entering: type 50 > debug3: mm_inform_authserv entering > debug3: monitor_read: checking request 50 > debug3: mm_request_send entering: type 3 > debug1: PAM: initializing for "username" > debug3: mm_inform_authrole entering > debug3: mm_request_send entering: type 4 > debug2: input_userauth_request: try method none > debug3: Wrote 96 bytes for a total of 2661 > debug1: PAM: setting PAM_RHOST to "10.5.5.57" > debug1: PAM: setting PAM_TTY to "ssh" > debug2: monitor_read: 50 used once, disabling now > debug3: mm_request_receive entering > debug3: monitor_read: checking request 3 > debug3: mm_answer_authserv: service=ssh-connection, style= > debug2: monitor_read: 3 used once, disabling now > debug3: mm_request_receive entering > debug3: monitor_read: checking request 4 > debug3: mm_answer_authrole: role= > debug2: monitor_read: 4 used once, disabling now > debug3: mm_request_receive entering > debug1: userauth-request for user username service ssh-connection method > gssapi-with-mic > debug1: attempt 1 failures 0 > debug2: input_userauth_request: try method gssapi-with-mic > debug3: mm_request_send entering: type 38 > debug3: mm_request_receive_expect entering: type 39 > debug3: mm_request_receive entering > debug3: monitor_read: checking request 38 > debug3: mm_request_send entering: type 39 > debug3: mm_request_receive entering > Postponed gssapi-with-mic for username from 10.5.5.57 port 15076 ssh2 > debug3: Wrote 64 bytes for a total of 2725 > > > Here is the dub log of the successful login machine (sshd) > =========================================== > [root@collector1 ~]# /usr/sbin/sshd -p 22 -D -ddd -e > debug2: load_server_config: filename /etc/ssh/sshd_config > debug2: load_server_config: done config len = 687 > debug2: parse_server_config: config /etc/ssh/sshd_config len 687 > debug3: /etc/ssh/sshd_config:21 setting Protocol 2 > debug3: /etc/ssh/sshd_config:36 setting SyslogFacility AUTHPRIV > debug3: /etc/ssh/sshd_config:66 setting PasswordAuthentication yes > debug3: /etc/ssh/sshd_config:70 setting ChallengeResponseAuthentication no > debug3: /etc/ssh/sshd_config:82 setting GSSAPICleanupCredentials yes > debug3: /etc/ssh/sshd_config:98 setting AcceptEnv LANG LC_CTYPE LC_NUMERIC > LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES > debug3: /etc/ssh/sshd_config:99 setting AcceptEnv LC_PAPER LC_NAME > LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT > debug3: /etc/ssh/sshd_config:100 setting AcceptEnv LC_IDENTIFICATION > LC_ALL LANGUAGE > debug3: /etc/ssh/sshd_config:101 setting AcceptEnv XMODIFIERS > debug3: /etc/ssh/sshd_config:107 setting X11Forwarding yes > debug3: /etc/ssh/sshd_config:120 setting UseDNS no > debug3: /etc/ssh/sshd_config:130 setting Subsystem sftp > /usr/libexec/openssh/sftp-server > debug3: /etc/ssh/sshd_config:137 setting KerberosAuthentication no > debug3: /etc/ssh/sshd_config:138 setting PubkeyAuthentication yes > debug3: /etc/ssh/sshd_config:139 setting UsePAM yes > debug3: /etc/ssh/sshd_config:140 setting GSSAPIAuthentication yes > debug3: /etc/ssh/sshd_config:141 setting AuthorizedKeysCommand > /usr/bin/sss_ssh_authorizedkeys > debug1: sshd version OpenSSH_5.3p1 > debug3: Not a RSA1 key file /etc/ssh/ssh_host_rsa_key. > debug1: read PEM private key done: type RSA > debug1: private host key: #0 type 1 RSA > debug3: Not a RSA1 key file /etc/ssh/ssh_host_dsa_key. > debug1: read PEM private key done: type DSA > debug1: private host key: #1 type 2 DSA > debug1: rexec_argv[0]='/usr/sbin/sshd' > debug1: rexec_argv[1]='-p' > debug1: rexec_argv[2]='22' > debug1: rexec_argv[3]='-D' > debug1: rexec_argv[4]='-ddd' > debug1: rexec_argv[5]='-e' > debug3: oom_adjust_setup > Set /proc/self/oom_score_adj from 0 to -1000 > debug2: fd 3 setting O_NONBLOCK > debug1: Bind to port 22 on 0.0.0.0. > Server listening on 0.0.0.0 port 22. > debug2: fd 4 setting O_NONBLOCK > debug1: Bind to port 22 on ::. > Server listening on :: port 22. > debug3: fd 5 is not O_NONBLOCK > debug1: Server will not fork when running in debugging mode. > debug3: send_rexec_state: entering fd = 8 config len 687 > debug3: ssh_msg_send: type 0 > debug3: send_rexec_state: done > debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8 > debug3: recv_rexec_state: entering fd = 5 > debug3: ssh_msg_recv entering > debug3: recv_rexec_state: done > debug2: parse_server_config: config rexec len 687 > debug3: rexec:21 setting Protocol 2 > debug3: rexec:36 setting SyslogFacility AUTHPRIV > debug3: rexec:66 setting PasswordAuthentication yes > debug3: rexec:70 setting ChallengeResponseAuthentication no > debug3: rexec:82 setting GSSAPICleanupCredentials yes > debug3: rexec:98 setting AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME > LC_COLLATE LC_MONETARY LC_MESSAGES > debug3: rexec:99 setting AcceptEnv LC_PAPER LC_NAME LC_ADDRESS > LC_TELEPHONE LC_MEASUREMENT > debug3: rexec:100 setting AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE > debug3: rexec:101 setting AcceptEnv XMODIFIERS > debug3: rexec:107 setting X11Forwarding yes > debug3: rexec:120 setting UseDNS no > debug3: rexec:130 setting Subsystem sftp /usr/libexec/openssh/sftp-server > debug3: rexec:137 setting KerberosAuthentication no > debug3: rexec:138 setting PubkeyAuthentication yes > debug3: rexec:139 setting UsePAM yes > debug3: rexec:140 setting GSSAPIAuthentication yes > debug3: rexec:141 setting AuthorizedKeysCommand > /usr/bin/sss_ssh_authorizedkeys > debug1: sshd version OpenSSH_5.3p1 > debug3: Not a RSA1 key file /etc/ssh/ssh_host_rsa_key. > debug1: read PEM private key done: type RSA > debug1: private host key: #0 type 1 RSA > debug3: Not a RSA1 key file /etc/ssh/ssh_host_dsa_key. > debug1: read PEM private key done: type DSA > debug1: private host key: #1 type 2 DSA > debug1: inetd sockets after dupping: 3, 3 > Connection from 10.5.5.57 port 15110 > debug1: Client protocol version 2.0; client software version > PuTTY_Release_0.63 > debug1: no match: PuTTY_Release_0.63 > debug1: Enabling compatibility mode for protocol 2.0 > debug1: Local version string SSH-2.0-OpenSSH_5.3 > debug2: fd 3 setting O_NONBLOCK > debug2: Network child is on pid 7346 > debug3: preauth child monitor started > debug3: mm_request_receive entering > debug3: privsep user:group 74:74 > debug1: permanently_set_uid: 74/74 > debug1: list_hostkey_types: ssh-rsa,ssh-dss > debug1: SSH2_MSG_KEXINIT sent > debug3: Wrote 840 bytes for a total of 861 > debug1: SSH2_MSG_KEXINIT received > debug2: kex_parse_kexinit: > diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 > debug2: kex_parse_kexinit: ssh-rsa,ssh-dss > debug2: kex_parse_kexinit: > aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] > debug2: kex_parse_kexinit: > aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] > debug2: kex_parse_kexinit: > hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 > debug2: kex_parse_kexinit: > hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 > debug2: kex_parse_kexinit: none,[email protected] > debug2: kex_parse_kexinit: none,[email protected] > debug2: kex_parse_kexinit: > debug2: kex_parse_kexinit: > debug2: kex_parse_kexinit: first_kex_follows 0 > debug2: kex_parse_kexinit: reserved 0 > debug2: kex_parse_kexinit: > diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1 > debug2: kex_parse_kexinit: ssh-rsa,ssh-dss > debug2: kex_parse_kexinit: > aes256-ctr,aes256-cbc,[email protected],aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128 > debug2: kex_parse_kexinit: > aes256-ctr,aes256-cbc,[email protected],aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128 > debug2: kex_parse_kexinit: hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5 > debug2: kex_parse_kexinit: hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5 > debug2: kex_parse_kexinit: none,zlib > debug2: kex_parse_kexinit: none,zlib > debug2: kex_parse_kexinit: > debug2: kex_parse_kexinit: > debug2: kex_parse_kexinit: first_kex_follows 0 > debug2: kex_parse_kexinit: reserved 0 > debug2: mac_setup: found hmac-sha2-256 > debug1: kex: client->server aes256-ctr hmac-sha2-256 none > debug3: mm_request_send entering: type 78 > debug3: monitor_read: checking request 78 > debug3: mm_request_send entering: type 79 > debug3: mm_request_receive entering > debug3: mm_request_receive_expect entering: type 79 > debug3: mm_request_receive entering > debug2: mac_setup: found hmac-sha2-256 > debug1: kex: server->client aes256-ctr hmac-sha2-256 none > debug3: mm_request_send entering: type 78 > debug3: monitor_read: checking request 78 > debug3: mm_request_send entering: type 79 > debug3: mm_request_receive entering > debug3: mm_request_receive_expect entering: type 79 > debug3: mm_request_receive entering > debug1: SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received > debug3: mm_request_send entering: type 0 > debug3: monitor_read: checking request 0 > debug3: mm_answer_moduli: got parameters: 1024 4096 8192 > debug3: mm_choose_dh: waiting for MONITOR_ANS_MODULI > debug3: mm_request_receive_expect entering: type 1 > debug3: mm_request_receive entering > debug3: mm_request_send entering: type 1 > debug3: mm_choose_dh: remaining 0 > debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent > debug3: Wrote 536 bytes for a total of 1397 > debug2: monitor_read: 0 used once, disabling now > debug3: mm_request_receive entering > debug2: dh_gen_key: priv key bits set: 283/512 > debug2: bits set: 2035/4096 > debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT > debug2: bits set: 2100/4096 > debug3: mm_key_sign entering > debug3: mm_request_send entering: type 5 > debug3: monitor_read: checking request 5 > debug3: mm_answer_sign > debug3: mm_answer_sign: signature 0x7f9e4e6c8010(271) > debug3: mm_request_send entering: type 6 > debug2: monitor_read: 5 used once, disabling now > debug3: mm_request_receive entering > debug3: mm_key_sign: waiting for MONITOR_ANS_SIGN > debug3: mm_request_receive_expect entering: type 6 > debug3: mm_request_receive entering > debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent > debug2: kex_derive_keys > debug2: set_newkeys: mode 1 > debug2: cipher_init: set keylen (16 -> 32) > debug1: SSH2_MSG_NEWKEYS sent > debug1: expecting SSH2_MSG_NEWKEYS > debug3: Wrote 1104 bytes for a total of 2501 > debug2: set_newkeys: mode 0 > debug2: cipher_init: set keylen (16 -> 32) > debug1: SSH2_MSG_NEWKEYS received > debug1: KEX done > debug3: Wrote 64 bytes for a total of 2565 > debug1: userauth-request for user username service ssh-connection method none > debug1: attempt 0 failures 0 > debug3: mm_getpwnamallow entering > debug3: mm_request_send entering: type 7 > debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM > debug3: mm_request_receive_expect entering: type 8 > debug3: mm_request_receive entering > debug3: monitor_read: checking request 7 > debug3: mm_answer_pwnamallow > debug2: parse_server_config: config reprocess config len 687 > debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1 > debug3: mm_request_send entering: type 8 > debug2: monitor_read: 7 used once, disabling now > debug3: mm_request_receive entering > debug2: input_userauth_request: setting up authctxt for username > debug3: mm_start_pam entering > debug3: mm_request_send entering: type 50 > debug3: mm_inform_authserv entering > debug3: mm_request_send entering: type 3 > debug3: mm_inform_authrole entering > debug3: mm_request_send entering: type 4 > debug2: input_userauth_request: try method none > debug3: Wrote 96 bytes for a total of 2661 > debug3: monitor_read: checking request 50 > debug1: PAM: initializing for "username" > debug1: userauth-request for user username service ssh-connection method > gssapi-with-mic > debug1: attempt 1 failures 0 > debug2: input_userauth_request: try method gssapi-with-mic > debug3: mm_request_send entering: type 38 > debug3: mm_request_receive_expect entering: type 39 > debug3: mm_request_receive entering > debug1: PAM: setting PAM_RHOST to "10.5.5.57" > debug1: PAM: setting PAM_TTY to "ssh" > debug2: monitor_read: 50 used once, disabling now > debug3: mm_request_receive entering > debug3: monitor_read: checking request 3 > debug3: mm_answer_authserv: service=ssh-connection, style= > debug2: monitor_read: 3 used once, disabling now > debug3: mm_request_receive entering > debug3: monitor_read: checking request 4 > debug3: mm_answer_authrole: role= > debug2: monitor_read: 4 used once, disabling now > debug3: mm_request_receive entering > debug3: monitor_read: checking request 38 > debug3: mm_request_send entering: type 39 > Postponed gssapi-with-mic for username from 10.5.5.57 port 15110 ssh2 > debug3: Wrote 64 bytes for a total of 2725 > debug3: mm_request_receive entering > debug3: mm_request_send entering: type 40 > debug3: mm_request_receive_expect entering: type 41 > debug3: mm_request_receive entering > debug3: monitor_read: checking request 40 > debug1: Got no client credentials > debug3: mm_request_send entering: type 41 > debug3: Wrote 208 bytes for a total of 2933 > debug3: mm_request_receive entering > debug3: mm_request_send entering: type 44 > debug3: mm_request_receive_expect entering: type 45 > debug3: mm_request_receive entering > debug3: monitor_read: checking request 44 > debug3: mm_request_send entering: type 45 > debug3: mm_request_send entering: type 42 > debug3: mm_request_receive_expect entering: type 43 > debug3: mm_request_receive entering > debug3: mm_request_receive entering > debug3: monitor_read: checking request 42 > Authorized to username, krb5 principal [email protected] (krb5_kuserok) > debug3: mm_answer_gss_userok: sending result 1 > debug3: mm_request_send entering: type 43 > debug3: mm_ssh_gssapi_userok: user authenticated > debug3: mm_do_pam_account entering > debug3: mm_request_send entering: type 51 > debug3: mm_request_receive_expect entering: type 52 > debug3: mm_request_receive entering > debug3: mm_request_receive_expect entering: type 51 > debug3: mm_request_receive entering > debug1: do_pam_account: called > debug3: PAM: do_pam_account pam_acct_mgmt = 0 (Success) > debug3: mm_request_send entering: type 52 > Accepted gssapi-with-mic for username from 10.5.5.57 port 15110 ssh2 > debug1: monitor_child_preauth: username has been authenticated by > privileged process > debug3: mm_get_keystate: Waiting for new keys > debug3: mm_request_receive_expect entering: type 25 > debug3: mm_request_receive entering > debug3: mm_do_pam_account returning 1 > debug3: Wrote 48 bytes for a total of 2981 > debug3: mm_send_keystate: Sending new keys: 0x7f9e4e6c6a20 0x7f9e4e6c8840 > debug3: mm_newkeys_to_blob: converting 0x7f9e4e6c6a20 > debug3: mm_newkeys_to_blob: converting 0x7f9e4e6c8840 > debug3: mm_send_keystate: New keys have been sent > debug3: mm_send_keystate: Sending compression state > debug3: mm_request_send entering: type 25 > debug3: mm_send_keystate: Finished sending state > debug3: mm_request_send entering: type 80 > debug3: mm_request_receive_expect entering: type 81 > debug3: mm_request_receive entering > debug3: mm_newkeys_from_blob: 0x7f9e4e6e5ec0(159) > debug2: mac_setup: found hmac-sha2-256 > debug3: mm_get_keystate: Waiting for second key > debug3: mm_newkeys_from_blob: 0x7f9e4e6e5ec0(159) > debug2: mac_setup: found hmac-sha2-256 > debug3: mm_get_keystate: Getting compression state > debug3: mm_get_keystate: Getting Network I/O buffers > debug3: mm_request_receive_expect entering: type 80 > debug3: mm_request_receive entering > debug3: mm_request_send entering: type 81 > debug3: mm_share_sync: Share sync > debug3: mm_share_sync: Share sync end > debug1: temporarily_use_uid: 756600344/756600344 (e=0/0) > debug1: No credentials stored > debug1: restore_uid: 0/0 > debug1: SELinux support disabled > debug1: PAM: establishing credentials > debug3: PAM: opening session > debug1: temporarily_use_uid: 756600344/756600344 (e=0/0) > debug1: No credentials stored > debug1: restore_uid: 0/0 > User child is on pid 7359 > debug3: mm_request_receive entering > debug1: PAM: establishing credentials > debug1: permanently_set_uid: 756600344/756600344 > debug2: set_newkeys: mode 0 > debug2: cipher_init: set keylen (16 -> 32) > debug2: set_newkeys: mode 1 > debug2: cipher_init: set keylen (16 -> 32) > debug1: Entering interactive session for SSH2. > debug2: fd 10 setting O_NONBLOCK > debug2: fd 11 setting O_NONBLOCK > debug1: server_init_dispatch_20 > debug1: server_input_channel_open: ctype session rchan 256 win 16384 max > 16384 > debug1: input_session_request > debug1: channel 0: new [server-session] > debug2: session_new: allocate (allocated 0 max 10) > debug3: session_unused: session id 0 unused > debug1: session_new: session 0 > debug1: session_open: channel 0 > debug1: session_open: session 0: link with channel 0 > debug1: server_input_channel_open: confirm session > debug3: Wrote 64 bytes for a total of 3045 > debug1: server_input_channel_req: channel 0 request pty-req reply 1 > debug1: session_by_channel: session 0 channel 0 > debug1: session_input_channel_req: session 0 req pty-req > debug1: Allocating pty. > debug3: mm_request_send entering: type 26 > debug3: monitor_read: checking request 26 > debug3: mm_answer_pty entering > debug2: session_new: allocate (allocated 0 max 10) > debug3: session_unused: session id 0 unused > debug1: session_new: session 0 > debug3: mm_request_send entering: type 27 > debug3: mm_answer_pty: tty /dev/pts/1 ptyfd 9 > debug3: mm_request_receive entering > debug3: mm_pty_allocate: waiting for MONITOR_ANS_PTY > debug3: mm_request_receive_expect entering: type 27 > debug3: mm_request_receive entering > debug1: session_pty_req: session 0 alloc /dev/pts/1 > debug1: server_input_channel_req: channel 0 request shell reply 1 > debug1: session_by_channel: session 0 channel 0 > debug1: session_input_channel_req: session 0 req shell > debug2: fd 3 setting TCP_NODELAY > debug2: channel 0: rfd 14 isatty > debug2: fd 14 setting O_NONBLOCK > debug3: fd 12 is O_NONBLOCK > debug3: Wrote 160 bytes for a total of 3205 > debug1: Setting controlling tty using TIOCSCTTY. > debug3: Wrote 112 bytes for a total of 3317 > debug3: Wrote 400 bytes for a total of 3717 > debug3: Wrote 160 bytes for a total of 3877 > > > > > -- > Manage your subscription for the Freeipa-users mailing list: > https://www.redhat.com/mailman/listinfo/freeipa-users > Go to http://freeipa.org for more info on the project -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project
